Event-Driven Notification Platform · View 08 of 26 · 2 · Structure

Multi-Tenancy and Noisy-Neighbour Control

What every tenant shares, what each one gets alone, and what stops one from hurting the rest.

Editable source SVG draw.io All views

Decisions

Shared compute by default; isolation is a purchasable tier, not the baseline architecture
Isolation is enforced in four independent places: gateway quota, topic ACL, row-level security and per-tenant encryption key
Priority tiering runs end to end, so isolation survives the queue as well as the request

Noisy-neighbour controls

Per-tenant requests per second with burst at the gateway, returning 429 with Retry-After
Per-tenant per-channel consumer concurrency cap, so one tenant cannot occupy the worker pool
Circuit breakers scoped to tenant and provider together, so one tenant's bad endpoint does not trip another's

Unresolved risk

One Flink job serves all tenants; a single hot key can lag its partition and delay unrelated tenants on that partition
Mitigated by key salting on the bulk tier only — salting the transactional tier would break per-entity ordering
Owner: platform engineering. Needs a decision on dedicated jobs for the top five tenants before go-live

◀ Template and Content Lifecycle All views Data Flow ▶